4

Good Afternoon,

Seeking advice for setting security on a custom SP2013 list.

All users need to be able to create a new item in the list. Users should not see items created by others.

So far, I set secuiry as follows: The list has unique permissions, not inheritting from any parent. A group named "Everyone" have contribute rights

Under List Settings - Advanced - Item Level Security:

"Read access" is set to "Read items that were created by the user"

"Create and Edit access" is set to "Create items and edit items that were created by the user"

This almost achieves my requirements, with one limitation. Sometimes, a users secretary fills out a list item for their boss. In that case, the boss cannot see or edit the item in the future. Only the secretary can read and edit.

There is only 1 secretary, so I thought that I may be able to draft a how-to on changing the security of the item (stop inheritance) and add the boss with "Full Control" on the list item.

My assumption was the Full Control would over-ride the default item-level-security set on the list as mentioned above. I have found that is not the case. When we email a link to the item to the boss after granting him full control on the item, the link is bad for him in the email. We know the link is good because it works for us, so we know this is a permissions issues.

I tried changing "Create and Edit access" is set to "Create and edit all items" however the link still does not work for the boss.

The boss should not see list items created by others.

Any advice?

Thanks!

-Mike

  • What options do you have in terms of possible solution - can you use server side code? Client object model? Or you may use only out of the box features? – jjczopek Sep 18 '15 at 20:41
0

Solution 1: Below is one solution for your problem by breaking the inheritance:

  1. Keep the permission broken for the list.
  2. Remove the Item level security.
  3. Create a new column(person or group column) in the list lets say "Created For".Keep this column as optional.
  4. Every time the secretary fills data for Boss , make her/him fill the boss's name in the Created For column.
  5. Create a simple SharePoint designer workflow to break permission on the list item and assign read/edit permission to Created By and Created For users.

See this blog to break inheritance using designer workflow. Make sure you select SharePoint 2010 workflow while creating the workflow.

Solution 2: Breaking the inheritance is not very recommended approach as it could make the list access slower. So another approach could be to not break the inheritance but to hide users from others data by adding extra filters to the View.

  1. Do no break the inheritance.
  2. Remove the item level security.
  3. Create a new column(person or group column) in the list lets say "Created For".Keep this column as optional.
  4. Every time the secretary fills data for Boss , make her/him fill the boss's name in the Created For column.
  5. Edit the All items view and the extra filters Created By= [Me] OR Created For= [Me].

Make sure users do not have the permission to edit the view and see others data.

  • Thank you for your comment. I am going to test this week. – user3290881 Sep 21 '15 at 19:29
  • Solution 1 seems more secure. Solution 2 seems easier to implement. I am weighing the pros and cons. I may end up with Solution 1. Regarding Solution 2, while I can lock down views, I am concerned that a clever user may be able to manually edit the URL of the edit/display form to change the ID in the URL string to view other another users data. Then again, I am not sure how realistic that scenario is... – user3290881 Sep 21 '15 at 19:40
0

Changing value of Created by field seems to do the trick. After changing this value the secretary will no longer see the item, but your boss will.

I was able change the value using PowerShell and following JavaScript:

var context = SP.ClientContext.get_current()
var web = context.get_web()
var list = web.get_lists().getByTitle('Test') //title of the list
var item = list.getItemById(1) //id of the list item to change
item.set_item('Author', '13') //id of your boss
item.update()
context.executeQueryAsync(null, alert)

I've written this code in browser console so it needs a little work.

I've also tried to change this value using REST. I was able to change other user fields, but not the Author.

If you need no-code solution, you may check if it's possible to change this field using workflow.

  • Thank you for your comment. Changing the Created by field using workflow is in interesting code free solution. I looked into it a bit and found that created by is hidden by default in the SP Designer Worflow as it is a read only field. As a site collection admin I do not have access to change this on the server. Thank you for the shareing the powershell script. – user3290881 Sep 21 '15 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.